派谱/PairPulse

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 0.1.2

Overview

The skill’s purpose is coherent, but it asks agents to install and automatically upgrade an unpinned PyPI tool that reads customer order spreadsheets, so users should review it before use.

Review the PairPulse package and its source before installing, prefer a virtual environment or container, pin a reviewed version instead of auto-upgrading, and only run it on spreadsheets and directories you intend the agent to access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party Package Installation and Automatic Upgrades

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37-40 and SKILL.md:102-108
Vulnerability Type: Unverified and mutable third-party dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:37-40:

bash

pip install pairpulse

SKILL.md:102-108:

bash

pip install --upgrade pairpulse

Technical Analysis

The skill instructs an agent to install and subsequently upgrade the pairpulse package from PyPI without specifying an exact version, cryptographic hash, lockfile, or package-signature verification procedure. Consequently, the code installed at runtime can differ from the code that was reviewed during this audit.

Python package installation may execute package-controlled build or installation logic with the privileges of the invoking user. The automatic upgrade recommendation further increases exposure because every future release becomes implicitly trusted without an intervening security review.

The repository contains only SKILL.md; it does not include the referenced package implementation. Therefore, the package's runtime behavior and the claim that customer data remains local cannot be independently verified from the audited artifact.

Attack Path

1. An attacker compromises the PyPI publisher account, distribution process, upstream source, or another component of the package supply chain.
2. The attacker publishes a malicious version of pairpulse.
3. An agent follows the skill instructions and runs pip install pairpulse or pip install --upgrade pairpulse.
4. Pip retrieves the mutable, attacker-controlled release and may execute package build or installation code.
5. The malicious package runs with the invoking user's permissions.
6. During installation or later analysis, it can access files available to that user, including the order data passed to the tool, and communicate with external systems if network access is available.

Impact Assess

...[truncated 689 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pairpulse to an exact, security-reviewed version instead of installing the latest available release.
2. Download and review the package and its transitive dependencies before approving them for use.
3. Require cryptographic hashes through a locked requirements file and install with pip --require-hashes.
4. Remove the automatic upgrade recommendation. Treat each upgrade as a controlled change requiring review, testing, and explicit approval.
5. Verify package publisher and source-repository provenance before installation.
6. Use a dedicated virtual environment or isolated container with minimal filesystem permissions and no unnecessary credentials.
7. Disable outbound network access while processing sensitive order data unless it is explicitly required and approved.
8. Run the package as a nonprivileged user and grant access only to the specific input and output paths needed for the analysis.
9. Document the reviewed version and hashes directly in the skill so that installations are reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent/user to run pip install pairpulse and pip install --upgrade pairpulse without any warning that these commands modify the local Python environment and pull code from an external package source. In an agent context, this can lead to unintended package installation, dependency changes, or execution of unreviewed code, especially if the user did not explicitly consent to environment modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill advertises compatibility with agents that can execute shell commands and process local Excel files, but it does not clearly warn that using the skill involves local command execution against user-supplied data. This omission can cause users to underestimate the trust boundary and the risks of letting an agent invoke CLI tools on local files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.